CVE-2026-93320

What it actually does

BuildKit accepts build contexts containing special file inodes (devices, FIFOs, sockets) and performs file operations on them as if they were regular files, enabling blocking I/O or unintended host device access on rootful workers.

Why it matters to the business

Build pipelines can be stalled or used to access host devices, disrupting CI/CD operations and potentially allowing container-to-host access in privileged build environments.

How an attack unfolds

An attacker supplies a malicious build context or Dockerfile that includes specially crafted inodes; BuildKit processes these inodes during file operations, causing the worker to block or expose host devices when running with root privileges.

How to fix it

Upgrade BuildKit to a version that validates file types and rejects special inodes before performing operations; run workers as non-root where possible.

How to confirm the fix worked

Compare installed BuildKit version against vendor advisories; attempt to build with test contexts containing device nodes and confirm operations are rejected.

Typical attack path

1. Craft build context containing device nodes or blocking files
2. Submit build request to BuildKit daemon
3. Trigger file copy or extraction operations on the special inodes
4. Cause worker process to block or access host devices

How to detect it

Review BuildKit daemon logs for file operation errors involving non-regular inodes; monitor for unexpected device access attempts during image builds.

What your security team should do

• Prioritize upgrading BuildKit on all build hosts within the next patch cycle
• Enforce non-root worker execution in build configurations
• Add build-context scanning for special file types in CI pipelines